invisible file name in action attribute of a form

Question

veledrom 32 Master Poster

14 Years Ago

Hi,

Can we make secret.php bit invisible in action attribute of a form? I don't want users seing my post pages.

<form name='form1' method='post' action='secret.php'>

Thanks

php

5 Contributors
18 Replies
20K Views
2 Days Discussion Span
Latest Post 14 Years Ago Latest Post by diafol

All 18 Replies

Kavitha Butchi 0 Junior Poster in Training

14 Years Ago

How about posting the form values to mask1.php page and including a redirect header with required values to your secret.php page and again redirecting it to final.php page with the computed values. This is a quick thought from my side, let me know if it works. I m sure there is better sol fr this prob.

Edited 14 Years Ago by Kavitha Butchi because: n/a

diafol

14 Years Ago

There shouldn't be an issue with this as long as you lock down the code with form validation. All the data should be checked for datatype and sanitized. You could create a hashed verification code with the form to ensure that it was sent from that page (not spoofed), although this can be circumvented. Making multiple redirects sounds a bit extreme.

almostbob 866 Retired: passive income ROCKS

14 Years Ago

php forms
self posting, the user sees very little not even a filename, everything is on the server

<?php // form processing verification
if isset($_post['bla bla bla']) { /*mysql bla bla bla etc */ }
?>
<html><head></head><body><form method='post' name='form1'>

the default action for a form is to post to itself

Edited 14 Years Ago by almostbob because: n/a

vaultdweller123 32 Posting Pro

14 Years Ago

you mean u dont want user see where the form redirected when the user view its source code?

<?php

if(isset($_POST['btnsubmit'])){
echo "<script>window.location='secret.php';</script>";
}

?>
<form name='form1' method='post'>
<input type='submit' name='btnsubmit' value='go' />
</form>

tried and tested....this should hide the action attribute of the form... but it still show in the url. if you want to change the url. then you have to use .htaccess. after all you only want the action attribute to be invisible... so i just give u what u ask.

diafol

14 Years Ago

@AB - thanks - straightforward - cutting through the nonsense as usual. How about validation? Will lacking an action attribute cause failure?

As for js redirects: will not the client pick up the redirect as it is client-based (js), i.e. redirect after page has loaded. Whereas (*I think*) the php header() will redirect before page load on client and therefore hide its tracks. Thought WCAG had suggested that all redirects should be server-side. Maybe wrong here.

What about page refresh? Won't sending the form to itself resend the form on refresh?

Is all this 'hiding' necessary in the first place? $_SERVER could check the 'sender' and if it is not the form sending page - alert, alert, alert. I know it can't be trusted 100%.

$_SESSION variables could be used to store a string (e.g. salt + unixdatetime + another salt) which could be checked against a hidden field (hashed) in the form.

The receiving form handler page then checks the session variable for a value and then hashes it and then compares it to the hidden form field. If 'true' then form "must" have come from the true form page. Where 'false' bounce user back to form page with a message.

Edited 14 Years Ago by diafol because: n/a

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

vaultdweller123 32 Posting Pro · Answer 1 · 2010-01-29T21:27:49+00:00

ei by the way im not copying AB's post. Actually when i read this post, i only see kivata and ardav post. And im pretty slow coz. i test it 1st and run on my localhost before i submit my solutions. Upon submitting i was surprise AB's post 1st on my post.

diafol · Answer 2 · 2010-01-29T21:40:06+00:00

ei by the way im not copying AB's post. Actually when i read this post, i only see kivata and ardav post. And im pretty slow coz. i test it 1st and run on my localhost before i submit my solutions. Upon submitting i was surprise AB's post 1st on my post.

Yeah, yeah. I always use that excuse too! :icon_lol:

vaultdweller123 32 Posting Pro · Answer 3 · 2010-01-29T21:46:19+00:00

Yeah, yeah. I always use that excuse too! :icon_lol:

waaaaaaaaaaaaaaaaa! seriously dude! i didn't mean it!

almostbob 866 Retired: passive income ROCKS · Answer 4 · 2010-01-29T22:13:47+00:00

@AB - thanks - straightforward - cutting through the nonsense as usual. How about validation? Will lacking an action attribute cause failure?

no the default action is valid to xhtml and html5, it is only necessary to supply an action if the form is NOT posting to itself

As for js redirects: will not the client pick up the redirect as it is client-based (js), i.e. redirect after page has loaded. Whereas (*I think*) the php header() will redirect before page load on client and therefore hide its tracks. Thought WCAG had suggested that all redirects should be server-side. Maybe wrong here.

quite correct, the php given should have used a header redirect

What about page refresh? Won't sending the form to itself resend the form on refresh?

no 'post' destroys the data

Is all this 'hiding' necessary in the first place? $_SERVER could check the 'sender' and if it is not the form sending page - alert, alert, alert. I know it can't be trusted 100%.
$_SESSION variables could be used to store a string (e.g. salt + unixdatetime + another salt) which could be checked against a hidden field (hashed) in the form.
The receiving form handler page then checks the session variable for a value and then hashes it and then compares it to the hidden form field. If 'true' then form "must" have come from the true form page. Where 'false' bounce user back to form page with a message.

didnt suggest the process was necessary, but the OP could be creating the login page for nuclear missile control sites.... :)

Lgin: xxJoshua,
'Hello Doctor, Do you want to play a game?'
Global Thermonuclear War

only they know how much security/obscurity they require

diafol · Answer 5 · 2010-01-29T23:11:30+00:00

Thank you AB - eye in it's place - as usual. Yes, noticed OP wanted anonymity. Funny, but I can't see how no action attribute in form is more 'secure' when viewed in 'view source' as it is obvious that the form is being sent to its parent page.

You sure about that 'post' thing? I did a quick mock-up - sent the form - refreshed/reloaded page and got a browser popup asking if I wanted to resend the data.

almostbob 866 Retired: passive income ROCKS · Answer 6 · 2010-01-30T03:27:58+00:00

browser actions and published standards are out of sync again
the
you are probably right, but a form page would not redisplay the page on submit, it would either display a totally different page without the form, or resub the form is a valid action

<?if isset($_submit['something']) {echo 'completed form page html'} else { echo 'form page html' /* or redirect */ }?>

diafol · Answer 7 · 2010-01-30T04:23:55+00:00

diafol

14 Years Ago

OK AB. Thanks again.

veledrom 32 Master Poster · Answer 8 · 2010-01-30T18:59:54+00:00

It seems to me that what I want is a bit unnecessary. Therefore, I'll just use

<?php
if(isset($_POST["submitButton"]) && $_POST["submitButton"] == "ADD" &&
   isset($_POST["hiddenId"]) && isset($_POST["hiddenTitle"]) &&
   isset($_POST["hiddenPrice"]) && isset($_POST["hiddenPage"])){

    require_once "class/class.shop.php";

    $itemId = $_POST["hiddenId"];
    $itemTitle = $_POST["hiddenTitle"];
    $itemPrice = $_POST["hiddenPrice"];
    $returnPage = $_POST["hiddenPage"];
    
    //And other things

    header("location: ".$returnPage);   //Go back where you came from
    exit;

} else {
    header("location: index.php");
    exit;
}
?>

Do you think this is OK?

diafol · Answer 9 · 2010-01-31T02:02:29+00:00

from a redirection/post check point of view - looks fine to me. Your only problem could come from form spoofers, where they copy your form code (html), place it in a page on their own webserver pointed at your "action" reference or the page containing the form. This way they can change your hidden attributes to whatever they want. Therefore you need a strict data validation routine. I suggested a hash solution - perhaps that would solve the spoofing - but haven't tried it myself, so can't comment further.

veledrom 32 Master Poster · Answer 10 · 2010-01-31T15:42:19+00:00

Understood. You are right. Is there any example for me to solve this spoofing problem that I can apply to my above example?
Thanks

diafol · Answer 11 · 2010-01-31T17:11:04+00:00

I suggested a hash solution

Try it.

veledrom 32 Master Poster · Answer 12 · 2010-01-31T17:23:38+00:00

Do you mean something like this. Is this good enough?

index.php

<form action="process.php" method="post">
<input type='hidden' name='hiddenEncrypted'  value='c6d8d5bad9d62f25fbf5dd89d589b9d5b04b59e2' />
<input type='submit' name='submitButton'  value='ADD' />
</form>

process.php

<?php
if(isset($_POST["submitButton"]) && $_POST["submitButton"] == "ADD" &&
  isset($_POST["hiddenEncrypted"]) &&  $_POST["hiddenEncrypted"] == SHA1("123ABC")){

    require_once "class/class.shop.php";

    $itemId = $_POST["hiddenId"];
    $itemTitle = $_POST["hiddenTitle"];
    $itemPrice = $_POST["hiddenPrice"];
    $returnPage = $_POST["hiddenPage"];
    
    //And other things

    header("location: ".$returnPage);   //Go back where you came from
    exit;

} else {
    header("location: index.php");
    exit;
}
?>

diafol · Answer 13 · 2010-02-01T05:29:44+00:00

No. I don't think that'll work, because the hash is static - there's no degree of variability nor a session variable to check it against.

In your form page:

...
$confirmstring = md5("xxxYDi092" . time() . "xReb69gyT");
$_SESSION['form7confirmstring'] = $confirmstring;
...
<input type = "hidden" id="confirm" name="confirm" value="<?php echo $confirmstring;?>" />
...

In your form handling page (or top of your form page if sending to self):

if(!isset($_POST['confirm']) || !isset($_SESSION['form7confirmstring']) || $_POST['confirm'] != $_SESSION['form7confirmstring']){
    header("Location:http://www.example.com/index.php?msg=error6");
    exit;
}

invisible file name in action attribute of a form

Recommended Answers Collapse Answers

All 18 Replies

Recommended Answers